- Culture Lab
- 90% people
Every organisation that calls its staff the weakest link has already decided not to invest in them.
That is a budget decision presented as an observation. This section is the 90%: the part of the problem that procurement does not close.
Status
- Posts published
- 0
- Topics planned
- 3
Nothing is published here yet. The argument on this page is stated in full; the topics below are labelled Planned and none of them are written.
The controls are usually deployed
What fails is the fit between the control and the operator running it under load. None of it is remediated by procuring another product, which is inconvenient, because another product is what the industry is set up to sell.
- Control bypassed
A control gets disabled because it blocked legitimate work.
- Queue over capacity
An alert goes unread because the queue exceeds shift capacity.
- Process assumption
A process assumes user behaviour with no incentive behind it.
What gets written here
This section is where I work that out in writing. It is the half of the job that does not end in a PDF of detection rules.
- Planned
Phishing simulations that teach instead of punish
Click rate measures the test, not the risk. What a simulation programme looks like when the objective is a workforce that reports rather than one that is afraid of failing.
- Planned
Security champions that outlast the person who started them
Most champion programmes are one enthusiastic engineer with no budget line. What has to be true structurally for one to survive a reorganisation.
- Planned
Reading an alert queue as a human-factors problem
Alert fatigue is usually described as a tuning failure. It is also a staffing and attention problem, and the tuning fix alone has never resolved it.
Technology
The 10% is the part that is already published.
The technical work these arguments come out of is in The Lab: the research record, with the dates and the sources that were recovered for it. This section will list posts the same way, once they exist.